gemxray 0.1.0

data/lib/gemxray/editors/github_pr.rb

@@ -0,0 +1,222 @@
+# frozen_string_literal: true
+
+require "open3"
+require "pathname"
+
+module GemXray
+  module Editors
+    class GithubPr
+      attr_reader :config
+
+      def initialize(config)
+        @config = config
+      end
+
+      def create(results, per_gem: config.github_per_gem?, bundle_install: config.github_bundle_install?, comment: false)
+        ensure_git_repository!
+        ensure_clean_worktree!
+
+        pull_requests =
+          if per_gem
+            create_per_gem_pull_requests(results, bundle_install: bundle_install, comment: comment)
+          else
+            [create_single_pull_request(results, bundle_install: bundle_install, comment: comment)]
+          end
+
+        raise Error, "no Gemfile changes were created" if pull_requests.empty?
+
+        primary = pull_requests.first
+        {
+          branch: primary[:branch],
+          commits: primary[:commits],
+          pr_url: primary[:pr_url],
+          pull_requests: pull_requests
+        }
+      end
+
+      private
+
+      def create_single_pull_request(results, bundle_install:, comment:)
+        branch_name = branch_name_for
+        create_branch_from_base!(branch_name)
+
+        editor = GemfileEditor.new(config.gemfile_path)
+        commits = [create_single_commit(editor, results, comment: comment)].compact
+        lockfile_commit = install_and_commit_lockfile(editor) if bundle_install
+        commits << lockfile_commit if lockfile_commit
+
+        raise Error, "no Gemfile changes were created" if commits.empty?
+
+        push_branch!(branch_name)
+        pr_url = create_pull_request!(results, branch_name)
+        { branch: branch_name, commits: commits, pr_url: pr_url, gem_names: results.map(&:gem_name) }
+      end
+
+      def create_per_gem_pull_requests(results, bundle_install:, comment:)
+        results.filter_map do |result|
+          branch_name = branch_name_for(result.gem_name)
+          create_branch_from_base!(branch_name)
+
+          editor = GemfileEditor.new(config.gemfile_path)
+          commits = [create_single_commit(editor, [result], comment: comment)].compact
+          lockfile_commit = install_and_commit_lockfile(editor) if bundle_install
+          commits << lockfile_commit if lockfile_commit
+          next if commits.empty?
+
+          push_branch!(branch_name)
+          pr_url = create_pull_request!([result], branch_name)
+          {
+            gem_name: result.gem_name,
+            branch: branch_name,
+            commits: commits,
+            pr_url: pr_url
+          }
+        ensure
+          checkout_base_branch!
+        end
+      end
+
+      def install_and_commit_lockfile(editor)
+        editor.bundle_install!
+        lockfile = "#{config.gemfile_path}.lock"
+        return nil unless File.exist?(lockfile)
+        return nil unless tracked_changes?(relative_path(lockfile))
+
+        stage_and_commit!("chore: refresh Gemfile.lock after gem sweep", relative_path(lockfile))
+      end
+
+      def stage_and_commit!(message, *files)
+        run!("git", "add", *files)
+        run!("git", "commit", "-m", message)
+        message
+      end
+
+      def create_single_commit(editor, results, comment:)
+        outcome = editor.apply(results, dry_run: false, comment: comment, backup: false)
+        return nil if outcome.removed.empty?
+
+        commit_message = if outcome.removed.one?
+                           "chore: remove #{outcome.removed.first} from Gemfile"
+                         else
+                           "chore: sweep redundant gems"
+                         end
+        stage_and_commit!(commit_message, relative_path(config.gemfile_path))
+      end
+
+      def create_pull_request!(results, branch_name)
+        title = "chore: gemxray cleanup"
+        body = build_pr_body(results, branch_name)
+        create_pull_request_with_gh(title: title, body: body, branch_name: branch_name) || create_pull_request_with_api(
+          title: title,
+          body: body,
+          branch_name: branch_name
+        )
+      end
+
+      def build_pr_body(results, branch_name)
+        <<~BODY
+          ## Summary
+
+          gemxray generated this cleanup on branch `#{branch_name}`.
+
+          ## Removed Gems
+
+          #{results.map { |result| "- `#{result.gem_name}`" }.join("\n")}
+
+          ## Detection Grounds
+
+          #{results.map { |result| "- `#{result.gem_name}`: #{result.reasons.map(&:detail).join(' / ')}" }.join("\n")}
+
+          ## Checklist
+
+          - [ ] App boot check
+          - [ ] Primary workflow check
+          - [ ] `bundle exec rake spec`
+        BODY
+      end
+
+      def ensure_git_repository!
+        run!("git", "rev-parse", "--git-dir")
+      end
+
+      def ensure_clean_worktree!
+        raise Error, "git worktree must be clean before creating a cleanup PR" if tracked_changes?
+      end
+
+      def create_branch_from_base!(branch_name)
+        checkout_base_branch!
+        run!("git", "switch", "-c", branch_name)
+      end
+
+      def checkout_base_branch!
+        run!("git", "switch", config.github_base_branch)
+      end
+
+      def push_branch!(branch_name)
+        run!("git", "push", "-u", "origin", branch_name)
+      end
+
+      def run!(*command)
+        stdout, stderr, status = Open3.capture3(*command, chdir: config.project_root)
+        return stdout if status.success?
+
+        message = [stderr, stdout].map(&:strip).reject(&:empty?).first
+        raise Error, "#{command.join(' ')} failed: #{message}"
+      end
+
+      def relative_path(path)
+        Pathname.new(path).relative_path_from(Pathname.new(config.project_root)).to_s
+      end
+
+      def tracked_changes?(*paths)
+        args = ["git", "status", "--short"]
+        args.concat(paths) unless paths.empty?
+        !run!(*args).strip.empty?
+      rescue Error
+        true
+      end
+
+      def create_pull_request_with_gh(title:, body:, branch_name:)
+        command = ["gh", "pr", "create", "--base", config.github_base_branch, "--head", branch_name, "--title", title,
+                   "--body", body]
+        config.github_labels.each { |label| command += ["--label", label] }
+        config.github_reviewers.each { |reviewer| command += ["--reviewer", reviewer] }
+        run!(*command).strip
+      rescue Error
+        nil
+      end
+
+      def create_pull_request_with_api(title:, body:, branch_name:)
+        token = ENV["GH_TOKEN"] || ENV["GITHUB_TOKEN"]
+        raise Error, "gh is unavailable and no GitHub token is configured for API fallback" if token.to_s.empty?
+
+        client = GithubApiClient.new(token: token, repository: repository_slug)
+        client.create_pull_request(
+          base: config.github_base_branch,
+          head: branch_name,
+          title: title,
+          body: body,
+          labels: config.github_labels,
+          reviewers: config.github_reviewers
+        )
+      end
+
+      def repository_slug
+        return ENV["GITHUB_REPOSITORY"] unless ENV["GITHUB_REPOSITORY"].to_s.empty?
+
+        remote = run!("git", "remote", "get-url", "origin").strip
+        remote[%r{github\.com[:/](.+?)(?:\.git)?$}, 1] || raise(Error, "cannot determine GitHub repository from git remote")
+      end
+
+      def branch_name_for(gem_name = nil)
+        suffix = sanitize_branch_component(gem_name)
+        base = "gemxray/cleanup-#{Time.now.strftime('%Y%m%d')}"
+        suffix.empty? ? base : "#{base}-#{suffix}"
+      end
+
+      def sanitize_branch_component(value)
+        value.to_s.downcase.gsub(/[^a-z0-9]+/, "-").gsub(/\A-+|-+\z/, "")
+      end
+    end
+  end
+end

data/lib/gemxray/formatters/json.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "json"
+
+module GemXray
+  module Formatters
+    class Json
+      def render(report)
+        JSON.pretty_generate(report.to_h)
+      end
+    end
+  end
+end

data/lib/gemxray/formatters/terminal.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module GemXray
+  module Formatters
+    class Terminal
+      HEADER = "🧹 gemxray scan results"
+      SEPARATOR = "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+
+      def render(report)
+        lines = [HEADER, SEPARATOR, ""]
+
+        if report.results.empty?
+          lines << "No issues found."
+        else
+          report.results.each do |result|
+            lines << "[#{result.severity.to_s.upcase}] #{result.gem_name} (#{result.type_label})"
+            result.reasons.each_with_index do |reason, index|
+              marker = index == result.reasons.length - 1 ? "└─" : "├─"
+              lines << "  #{marker} #{reason.detail}"
+            end
+            lines << ""
+          end
+        end
+
+        summary = report.summary
+        lines << SEPARATOR
+        lines << "検出: #{summary[:total]}件 (DANGER: #{summary[:danger]}, WARNING: #{summary[:warning]}, INFO: #{summary[:info]})"
+        lines.join("\n")
+      end
+    end
+  end
+end

data/lib/gemxray/formatters/yaml.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+module GemXray
+  module Formatters
+    class Yaml
+      def render(report)
+        ::YAML.dump(report.to_h)
+      end
+    end
+  end
+end

data/lib/gemxray/gem_entry.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module GemXray
+  class GemEntry
+    attr_reader :name, :version, :groups, :line_number, :end_line, :source_line, :autorequire, :options
+
+    def initialize(name:, version: nil, groups: [], line_number: nil, end_line: nil, source_line: nil, autorequire: nil,
+                   options: {})
+      @name = name
+      @version = normalize_version(version)
+      @groups = Array(groups).map(&:to_sym).reject { |group| group == :default }.uniq
+      @line_number = line_number
+      @end_line = end_line || line_number
+      @source_line = source_line
+      @autorequire = autorequire
+      @options = options
+    end
+
+    def pinned_version?
+      !version.nil?
+    end
+
+    def development_group?
+      !(groups & %i[development test]).empty?
+    end
+
+    def gemfile_group
+      return nil if groups.empty?
+      return groups.first.to_s if groups.one?
+
+      groups.map(&:to_s)
+    end
+
+    def line_range
+      return nil unless line_number
+
+      line_number..(end_line || line_number)
+    end
+
+    def require_names
+      case autorequire
+      when false
+        []
+      when nil
+        default_require_names
+      else
+        Array(autorequire).compact.map(&:to_s).uniq
+      end
+    end
+
+    private
+
+    def normalize_version(value)
+      return nil if value.nil?
+
+      text = value.to_s.strip
+      text.empty? || text == ">= 0" ? nil : text
+    end
+
+    def default_require_names
+      [name, name.tr("-", "/"), name.tr("-", "_")].uniq
+    end
+  end
+end

data/lib/gemxray/gem_metadata_resolver.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "rubygems/package"
+require "rubygems/remote_fetcher"
+require "rubygems/spec_fetcher"
+
+module GemXray
+  class GemMetadataResolver
+    CONSTANT_PATTERN = /^\s*(?:class|module)\s+([A-Z][A-Za-z0-9_:]*)/.freeze
+    RemotePackage = Struct.new(:full_gem_path, :require_paths, keyword_init: true)
+
+    def initialize(cache_dir: File.join(Dir.home, ".gemxray", "cache", "gem_metadata"),
+                   spec_fetcher: Gem::SpecFetcher.fetcher,
+                   remote_fetcher: Gem::RemoteFetcher.fetcher)
+      @cache_dir = cache_dir
+      @spec_fetcher = spec_fetcher
+      @remote_fetcher = remote_fetcher
+      @constant_cache = {}
+      @railtie_cache = {}
+      @remote_package_cache = {}
+      @remote_fetch_available = true
+    end
+
+    def constant_candidates_for(gem_name, version_requirement: nil)
+      @constant_cache[cache_key(gem_name, version_requirement)] ||= begin
+        defaults = default_constant_candidates(gem_name)
+        discovered = gem_sources_for(gem_name, version_requirement).flat_map do |spec|
+          extract_constants(spec, gem_name)
+        end
+        (defaults + discovered).uniq
+      rescue StandardError
+        default_constant_candidates(gem_name)
+      end
+    end
+
+    def railtie?(gem_name, version_requirement: nil)
+      key = cache_key(gem_name, version_requirement)
+      return @railtie_cache[key] if @railtie_cache.key?(key)
+
+      @railtie_cache[key] = gem_sources_for(gem_name, version_requirement).any? do |spec|
+        all_ruby_files_for(spec, gem_name).any? do |path|
+          File.read(path, encoding: "utf-8").match?(/Rails::(?:Railtie|Engine)/)
+        rescue StandardError
+          false
+        end
+      end
+    rescue StandardError
+      @railtie_cache[key] = false
+    end
+
+    private
+
+    attr_reader :cache_dir, :spec_fetcher, :remote_fetcher
+
+    def cache_key(gem_name, version_requirement)
+      "#{gem_name}@#{version_requirement || 'latest'}"
+    end
+
+    def gem_sources_for(gem_name, version_requirement)
+      installed = installed_specs_for(gem_name, version_requirement)
+      return installed unless installed.empty?
+
+      remote_package = remote_package_for(gem_name, version_requirement)
+      remote_package ? [remote_package] : []
+    end
+
+    def installed_specs_for(gem_name, version_requirement)
+      requirement = build_requirement(version_requirement)
+      Gem::Specification.find_all_by_name(gem_name).select do |spec|
+        requirement.satisfied_by?(spec.version)
+      end
+    rescue StandardError
+      []
+    end
+
+    def remote_package_for(gem_name, version_requirement)
+      return nil unless @remote_fetch_available
+
+      key = cache_key(gem_name, version_requirement)
+      return @remote_package_cache[key] if @remote_package_cache.key?(key)
+
+      dependency = Gem::Dependency.new(gem_name, version_requirement || ">= 0")
+      found, errors = spec_fetcher.spec_for_dependency(dependency)
+      if found.empty?
+        @remote_fetch_available = false if errors.any?
+        return @remote_package_cache[key] = nil
+      end
+
+      spec, source = found.max_by { |(remote_spec, _)| remote_spec.version }
+      gem_path = remote_fetcher.download(spec, source.uri, cache_download_dir)
+      unpacked_path = unpack_gem(spec, gem_path)
+      @remote_package_cache[key] = RemotePackage.new(full_gem_path: unpacked_path, require_paths: Array(spec.require_paths))
+    rescue Gem::RemoteFetcher::FetchError, Gem::GemNotFoundException
+      @remote_fetch_available = false
+      @remote_package_cache[key] = nil
+    rescue StandardError
+      @remote_package_cache[key] = nil
+    end
+
+    def unpack_gem(spec, gem_path)
+      unpacked_path = File.join(cache_extract_dir, spec.full_name)
+      marker_path = File.join(unpacked_path, ".gemxray-extracted")
+      return unpacked_path if File.exist?(marker_path)
+
+      FileUtils.rm_rf(unpacked_path)
+      FileUtils.mkdir_p(unpacked_path)
+      Gem::Package.new(gem_path).extract_files(unpacked_path)
+      File.write(marker_path, spec.full_name)
+      unpacked_path
+    end
+
+    def cache_download_dir
+      File.join(cache_dir, "downloads")
+    end
+
+    def cache_extract_dir
+      File.join(cache_dir, "extracted")
+    end
+
+    def build_requirement(version_requirement)
+      Gem::Requirement.new(version_requirement || ">= 0")
+    rescue ArgumentError
+      Gem::Requirement.default
+    end
+
+    def default_constant_candidates(gem_name)
+      segments = gem_name.split(%r{[/_-]}).reject(&:empty?)
+      return [] if segments.empty?
+
+      camelized = segments.map { |segment| camelize(segment) }
+      [camelized.join, camelized.join("::")].uniq
+    end
+
+    def extract_constants(spec, gem_name)
+      gem_files_for(spec, gem_name).flat_map do |path|
+        File.readlines(path, chomp: true, encoding: "utf-8").filter_map do |line|
+          line[CONSTANT_PATTERN, 1]
+        end
+      rescue StandardError
+        []
+      end.uniq
+    end
+
+    def gem_files_for(spec, gem_name)
+      require_roots = spec.require_paths.map { |path| File.join(spec.full_gem_path, path) }
+      candidates = preferred_entry_files(require_roots, gem_name)
+      return candidates unless candidates.empty?
+
+      all_ruby_files_for(spec, gem_name)
+    end
+
+    def all_ruby_files_for(spec, gem_name)
+      require_roots = spec.require_paths.map { |path| File.join(spec.full_gem_path, path) }
+      preferred_entry_files(require_roots, gem_name) + require_roots.flat_map do |root|
+        Dir.glob(File.join(root, "**/*.rb"))
+      end.take(100)
+    end
+
+    def preferred_entry_files(require_roots, gem_name)
+      basenames = [
+        gem_name,
+        gem_name.tr("-", "/"),
+        gem_name.tr("-", "_")
+      ].uniq
+
+      basenames.flat_map do |basename|
+        require_roots.filter_map do |root|
+          path = File.join(root, "#{basename}.rb")
+          path if File.exist?(path)
+        end
+      end.uniq
+    end
+
+    def camelize(value)
+      value.split("_").map { |part| part[0]&.upcase.to_s + part[1..] }.join
+    end
+  end
+end

data/lib/gemxray/gemfile_parser.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require "bundler"
+
+module GemXray
+  class GemfileParser
+    DependencyEdge = Struct.new(:name, :requirement, keyword_init: true)
+
+    attr_reader :gemfile_path, :lockfile_path
+
+    def initialize(gemfile_path)
+      @gemfile_path = File.expand_path(gemfile_path)
+      @lockfile_path = "#{@gemfile_path}.lock"
+    end
+
+    def parse
+      @parse ||= begin
+        dependencies = bundler_dependencies
+        metadata = source_metadata.group_by(&:name)
+
+        if dependencies.empty?
+          source_metadata.map { |entry| build_entry_from_metadata(entry, []) }
+        else
+          dependencies.map do |dependency|
+            build_entry_from_dependency(dependency, metadata)
+          end
+        end
+      end
+    end
+
+    def dependency_tree
+      parser = lockfile_parser
+      return {} unless parser
+
+      parser.specs.each_with_object({}) do |spec, tree|
+        tree[spec.name] = spec.dependencies.map do |dependency|
+          DependencyEdge.new(name: dependency.name, requirement: dependency.requirement)
+        end
+      end
+    end
+
+    def ruby_version
+      parser = lockfile_parser
+      return RUBY_VERSION unless parser && parser.respond_to?(:ruby_version) && parser.ruby_version
+
+      text = parser.ruby_version.to_s
+      text[/\d+\.\d+(?:\.\d+)?/] || RUBY_VERSION
+    end
+
+    def rails_version(entries = parse)
+      parser = lockfile_parser
+      if parser
+        rails_spec = parser.specs.find { |spec| spec.name == "rails" }
+        return rails_spec.version.to_s if rails_spec
+      end
+
+      dependency = entries.find { |entry| entry.name == "rails" || entry.name == "railties" }
+      return nil unless dependency
+
+      dependency.version.to_s[/\d+\.\d+(?:\.\d+)?/]
+    end
+
+    def resolved_version(gem_name)
+      parser = lockfile_parser
+      return nil unless parser
+
+      parser.specs.find { |spec| spec.name == gem_name }&.version
+    end
+
+    private
+
+    def bundler_dependencies
+      Bundler::Dsl.evaluate(gemfile_path, nil, {}).dependencies
+    rescue StandardError
+      []
+    end
+
+    def build_entry_from_dependency(dependency, metadata)
+      declaration = metadata.fetch(dependency.name, []).shift
+      declaration ||= GemfileSourceParser::Metadata.new(name: dependency.name, options: {})
+      GemEntry.new(
+        name: dependency.name,
+        version: normalized_requirement(dependency.requirement),
+        groups: dependency.groups.empty? ? declaration.groups : dependency.groups,
+        line_number: declaration.line_number,
+        end_line: declaration.end_line,
+        source_line: declaration.source_line,
+        autorequire: declaration.options.fetch(:require, dependency.autorequire),
+        options: declaration.options
+      )
+    end
+
+    def build_entry_from_metadata(metadata_entry, default_groups)
+      options = metadata_entry.options
+      GemEntry.new(
+        name: metadata_entry.name,
+        version: metadata_entry.version,
+        groups: default_groups + metadata_entry.groups.to_a + extract_inline_groups(options),
+        line_number: metadata_entry.line_number,
+        end_line: metadata_entry.end_line,
+        source_line: metadata_entry.source_line,
+        autorequire: options[:require],
+        options: options
+      )
+    end
+
+    def normalized_requirement(requirement)
+      return nil unless requirement
+
+      text = Array(requirement.as_list).join(", ").strip
+      text.empty? || text == ">= 0" ? nil : text
+    end
+
+    def source_metadata
+      @source_metadata ||= GemfileSourceParser.new(gemfile_path).parse
+    end
+
+    def extract_inline_groups(options)
+      values = []
+      values.concat(Array(options[:group]))
+      values.concat(Array(options[:groups]))
+      values.map { |value| value.to_s.delete_prefix(":").to_sym }
+    end
+
+    def lockfile_parser
+      return nil unless File.exist?(lockfile_path)
+
+      @lockfile_parser ||= Bundler::LockfileParser.new(Bundler.read_file(lockfile_path))
+    rescue StandardError
+      nil
+    end
+  end
+end